NFT malware gains new evasion capabilities

A non-fungible token (NFT) is an entry on a blockchain associated with a digital or physical asset – usually a digital file such as an image, video or sound. An NFT’s ownership is registered in the blockchain, and it can be sold and traded. NFTs differ from cryptocurrencieswhich is most of it fungible, in that NFTs are unique and non-substitutable. The NFT market is booming, with trading volume exploding by over 20,000 percent from 2020 to 2021. Cybercriminals have rushed to capitalize on this trend, which the Morphisec Threat Labs team previously investigated in a white paper. The Threat Labs team now has fresh research on crypto and NFT malware NFT-001, which first surfaced in November 2020.

The NFT-001 attack sequence typically includes the following steps:

• Attackers target users in crypto and NFT communities on Discord and other forums
• The victim receives a private phishing message related to an NFT or financial opportunity. The message contains a link to a fake website and a malicious app that promises an improved user experience

• The downloaded malware packages a Remote Access Trojan (RAT) that is used to steal browser data, install a keylogger, and other surveillance features
• The attacker then uses the data for identity theft and to steal the victim’s wallet and other assets

The threat actor has now switched Babadeda encryption to a new incremental downloader while using the same delivery infrastructure as before. The new downloader adds session defense evasion capabilities of this malware.

New NFT-001 technical details

Morphisec Labs hair tracked several waves of the NFT malware delivers the Remco’s RAT since it first appeared. IN June 2022 we found a shift in crypter used to deliver Remco’s RAT. The Babadeda cscreeching is now discarded for a new step by step downloader.

Damage delivery hasn’t changed much. It sends a private message to a user enticing them to download a related application that allegedly gives the user access to the latest features. Below is an example of the phishing message targeting users of “Dune” – an Ethereum-based crypto data analysis platform.

IIf the user clicks on the hyperlink in the message, it directs them to a decoy website that mimics the original. There, the user is prompted to download the malicious “installer” that infects the victim’s machine with Remco’s RAT.

For more information on the infrastructure, read Morphisec’s previously mentioned white paper, “Journey of a Crypto Scammer.”

The new staged downloader

The threat actor keeps the first step “installers” with a low detection rate.

Execution starts by performing a User Account Control (UAC) bypass. It hijacks the default handler for ms settings protocol and sets it to execute a Powershell command that adds C:\ folder to the Windows Defender exclusion list. The code that performs this UAC bypass technique is well documented in the open source repository. But the attacker used it extremely poorly – he didn’t even bother to remove unnecessary WinAPI calls, such as printing to the console.

After excluding C:\ folder from Windows Defender, the following Powershell commands are de-obfuscated and executed:

1) The first Powershell command downloads and runs a regular Remcos RAT (C2 – 144.91.79)[.]86).

C2 used by Remco’s RAT was also seen in the wild in samples using the Babadeda crypter. This strengthens our suspicion that it is the same threat actor.

2) The second Powershell command downloads and runs Eternity Stealer which steals sensitive information from a victim’s machine such as:

• Browser information such as login information, history, cookies
• VPN and FTP client data
• Messaging Software Data
• Software data for password management

We also noticed a variant of this downloader in the Tandem espionage the campaign shares common features with this campaign:

• It is a similar UAC bypass technique that uses fodhelper.exe (less elusive implementation)
• Download and run two malicious executables (Arkei stealer and Eternity stealer)
• The Eternity thief is downloaded using the exact same Powershell command as the other Powershell command from the same URL

Although URL download The Eternity thief is the samewe believe that these may be two different threat actors who used the same downloads as a service.

Defense against NFT malware such as NFT-001

The crypto and NFT communities are at the forefront of financial innovation, and they are a lucrative target for attackers. This naturally means that there are greater opportunities for threat actors to exploit gaps in rapidly developing technology. This new incremental downloader for NFT-001 is more evasive than the previous version, increasing its ability to sneak past traditional cyber security solutions. According to the latest Picus report, defense evasion is now most popular tactic among malware operators.

This tactic is popular because there are not many effective tools against defense evasion. One such tool is Morphisec’s revolutionary Moving Target Defense (MTD) technology, which comprehensively prevents defense evasion techniques. Unlike other cybersecurity solutions that focus on detecting known patterns with response playbooks, MTD preemptively blocks memory and application attacks and eliminates the need for a response. To learn more about Morphisec’s revolutionary Moving Target Defense technology, read the white paper: Zero Trust + Moving Target Defense: The Ultimate Ransomware Strategy.

IOCs

Samples

Decoy sites